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This listing of claims will replace all prior versions, and listings, of claims in the application:) 
Listing of Claims: 

1 . (Currently Amended) Procedure A method for the analysis of the analvzing access to a data 
communication network by a user (LAN) , characterised by the fact that it comprises comprising: the 
operations of 

tracing (A1) the traffic of said user-4fcAN4 via a computer , and identifying a group of 
networks with which said traffic is mainly handled, by defining (+0©)-relative autonomous systems 
(AS) and tracing the sequence of autonomous systems crossed by said traffic; the tracing operat i o n 
of said sequence including: 

- a first stage-(B4}, to provide #re-ajist (102) of the-paths of autonomous systems crossed by 
said traffic to reach each destination, and 

- a second stage (B2) , to aggregately elaborate said list of paths, outputting a tree 
representing all the paths of the autonomous systems crossed by the traffic of said user (L AN) to 
reach all corresponding destination s each destination. 

wherein said second stage comprises providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one parameter including a percentage of use of 
the autonomous systems , 

2. (Currently Amended) Procedure A method as per claim 1, characterised by the fact that it 
comprises the operation o f comprising determining the routing of said traffic on the-branches of said 
tree, and the operation of associating the-respective indicative values of the traffic that crosses the 
branch to the branches of said tree. 

3. (Currently Amended) Procedure A method as per claim 1 or claim 2 , characterised by the fact 
that it comprises the operation o f comprising using hardware probes to trace the traffic of said user. 
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4. (Currently Amended) . Procedure A method as per claim 3, characterised by the fact that it 
comprises the operation o fc omprising configuring said hardware probes to provide information 
selected in from the-a_group consisting o fi ncluding : band use of the-an individual link, data volume, 
protocol-subdivision, IP address-subdivision, traffic matrix between the user (LAN) and the 
network. 

5. (Currently Amended) Procedure A method as per claim 3 or claim 4 , characterised by the fact 
that it comprises the operat i on o f comprising configuring said hardware probes to determine at least 
one selected item selected ift from the-a_group consi s ting o fi ncluding : sites most frequently visited by 
the user, main networks to which the user addresses its-traffic, and the origin of who connects up to 
said user. 

6. (Currently Amended) Procedure A method as per claim 1 or claim 2 , characterised by the fact 
that it comprises the operation o f comprising setting software agents on the data communication 
network access routers to trace said user traffic. 

7. (Currently Amended) Procedure A method as per claim 6, characterised by the fact that it 
comprises the operation o f comprising configuring said software agents to trace the traffic through 
the interface of the router of said user to determine the main traffic lines. 

8. (Currently Amended) Procedure A method as per claim 6, characterised by the fact that it 
compri s es the operation o f comprising configuring said software agents to analyse analyze the 
operating status of the respective router in terms of CPU load and available memory. 

9. (Currently Amended) Procedure A method as per claim 6, characterised by the fact that it 
comprises the operation o f comprising providing a target machine for the transfer of the statistics 
obtained by said routers. 
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10. (Currently Amended) Procedure A method as per claim 1, characterised by the fact that i t 
comprise s the operation o f comprising generating, as the result of said traffic tracing operation of 
said user, at least one parameter selected from the-a_group consisting o f including : destination 
networks of said traffic, percentage of traffic involved, and pertinent autonomous system. 

11. (Currently Amended) Procedur e A method as per claim 1, characterised by the fact that wherein 
said first stage (B4>-comprises the operations of inputting a file containing the IP addresses 
representing the sites most frequently visited by said user and performing a traceroute function for 
each destination site, by tracing the path to reach th4s -each destination site . 

12. (Currently Amended) Procedure A method as per claim 11, characterised by the fact that k 
comprises the operation o fc omprising tracing said path as a sequence of autonomous systems (AS) 
crossed. 

13. (Currently Amended) Procedure A method as per claim 1 1, c haracteri s ed by the fact tha t wherein 
in said first stage said tracing operations are carried out repeatedly with a given frequency. 

14. (Currently Amended) Procedure A method as per claim 13, characterised by the fact that wherein 
said frequency eaft- is configured to be determined and selected. 

15. (Currently Amended) Procedure A method as per claim 1, characterised by the fact that wherein 
said second stage (83)-comprises the operation of generating a unique tree of paths of the 
autonomous systems crossed by the traffic of said user to reach all the destinations, the- wherein 
leaves of said tree being-are indicative of the-destination subnetworks of the traffic of said user. 

16. (Currently Amended) Procedure A method as per claim 1, characterised by the fact that wherein 
s aid s econd stage (B2) comprises the operation of providing, in relation to the li s t of said 
autonomous systems crossed by said traffic of said user, the provided at least one parameter from: the 
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p e rc e ntage of use of the autonomous system j iirther includes at least one of a time value for passing 
through said autonomous systems and a hops value inside the autonomous system. 

17. (Currently Amended) Procedure A method as per claim 16, characterised by the fact that wherein 
at least one and preferable all said data-provided at least one parameter afe-is expressed as an 
average value. 

18. (Currently Amended) Procedure A method as per claim 1 or claim 11 , characterized by the fact 
that wherein said first stage (B4>-comprises the operation of invoking for each IP address generated 
via said traceroute trace function, a remote service to obtain at least one item of the~information 
included in the from a group consisting o fi ncluding : name of the autonomous system to which the 
generated IP address belongs and the number of the autonomous system to which said generated IP 
address belongs. 

19. (Currently Amended) Procedure A method as per claim 18, characterised by the fact that wherei n 
said remote service is the whois service of the databases RIBE, ARIN, APNIC. 

20. (Currently Amended) Procedure A method as per claim 1, characterised by the fact that wherein 
said first stage £B+}-comprises the operation of generating a data file O03) compri s ing including 
information selected from #^a_group consisting o fi ncluding : 

- order number of the autonomous system following the sequence of IP addresses provided 
by said traceroute trace function, 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has measured inside the autonomous system, 

and 

- time of permanence in the autonomous system measured by a single tracing command. 
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21. (Currently Amended) Procedur e A method as per claim 1 or claim 1 1 , charact e rized by the fact 
that it comprises the op e ration o f comprising performing a plurality of said tracing functions in 
parallel during said first stage. 

22. (Currently Amended) Procedure A method as per claim 1, characterised by the fact tha t wherein 
said second stage £B3f comprises the operation of storing information of correspondence between IP 
addresses and the-data relating to the pertinent autonomous systems. 

23. (Currently Amended) Procedure A method as per claim 1, characteri s ed by the fact that w herein 
said second stage £B3)-comprises the operation of generating tke-leaves of said tree as an 
identification of &e-destination subnetworks of the traffic of said user and the-relative branches as 
identifications of the autonomous systems crossed by the traffic. 

24. (Currently Amended) Procedure A method as per claim 1, characterised by the fact that wherein 
said second stage (62) is performed in association with a central memory with a data structure that 
represents the paths generated in said first stage in the form of at least one aggregated list. 

25. (Currently Amended) Procedure A method as per claim 24 5 characteri s ed by the fact that 
the vvherein said at least one aggregated list is identified as representing a variable number of 
autonomous system lists that share a common maximum prefix. 

26. (Currently Amended) Svstem -An apparatus for the analysis of the analyzing access to a data 
communication network by a user4LAN}, comprising: 

a processor; and 

memory storing software code that, when executed by the processor, performs: characterised 
by the fact that the sy s tem is configured to 

teee (AO the tracing traffic of said use r (LAN) ; 
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and idcntifv identifying a group of networks with which this-the traffic is mainly 
involved^ by identifying-(+0&) relative autonomous systems (AS) and tracing the sequence of 
autonomous systems crossed by said traffic; to trace said sy s tem the system including a fir s t module 
(B 1 ) that 

provides the providing a list-f4£2) of paths of autonomous systems crossed by said 
traffic to reach each destinationr-aftd: 

a s econd module (B2) to aggregately elaborate elaborating said list of paths by 
outputting a tree representing all the paths of the autonomous systems crossed by the traffic of said 
user (LAN) to reach all relative destinations each destination: and 

providing, in relation to the list of said autonomous systems crossed by said traffic of 
said user, at least one parameter including a percentage of use of the autonomous systems . 

27. (Currently Amended) System An apparatus as per claim 26, characterised by the fact 
that wherein the system- apparatus is configured to measure the routing of said traffic on the-branches 
of said tree and associate respective indicative values of the traffic crossing the branches to the 
branches of said tree. 

28. (Currently Amended) Svstem -An apparatus as per claim 26 or claim 27 , charac t erized by the 
fact that it comprises com prising hardware probes to trace the traffic of said user. 

29. (Currently Amended) System An apparatus as per claim 28, characterised by the fact 
feat wherein said hardware probes are configured to supply information selected in the group 
consisting of from a group including : use of single link band, data volume, protocol-subdivision, IP 
address-subdivision, traffic matrix between the user (LAN) and the network. 

30. (Currently Amended) Svstem- An apparatus as per claim 28 or claim 29 , characterized by the 
fact that wherein said hardware probes are configured to determine at least one item selected in the 
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gr o up consist i ng o f from a group including : sites most frequently visited by the user, main networks 
addressed by the user traffic, and origin of those who connect up to said user. 

3 1 . (Currently Amended) Sy s tem An apparatus as per claim 26 or claim 27 , characterized by th e 
fact that it comprises comprismg software agents on the-a_data communication network access router 
to trace the-said traffic of the user. 

32. (Currently Amended) System An apparatus as per claim 31, characterised by the fact 
■riwrt where in said software agents are configured to trace the traffic through the interface of the router 
of said user by determining the-main traffic lines. 

33. (Currently Amended) System An apparatus as per claim 31, characterised by the fact 
that wherein said software agents are configured to perform an analysis on the operating status of the 
respective router in terms of CPU load and available memory. 

34. (Currently Amended) System An apparatus as per claim 31, characterised by the fact that it 
comprises comprising a target machine for the transfer of the receiving statistics obtained by said 
routers. 

35. (Currently Amended) System An apparatus as per claim 26, characterised by the fact that 
i iwherein the apparatus is configured to generate as the-a/esult of said tracing operation of the traffic 
of said user at least one of the parameters parametcr selected from the group con s isting o f a group 
including : destination networks of said traffic, percentage of traffic involved, pertinent autonomous 
system. 

36. (Currently Amended) System An apparatus as per claim 26, characterised by the fa s* 
that wherein said modu l e (AO is apparatus is configured to input a file containing the-IP addresses 
representing the- destination sites most frequently visited by said user and to perform a tracing 
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operation (tracoroute) to this de s tination for each destination site, by tracing the path to reach th+s 
each destination site , 

37. (Currently Amended) System An apparatus as per claim 36, characterised by the fact 
that wherein said first module apparatus is configured to trace said path as a sequence of autonomous 
systems (ASf that are crossed. 

38. (Currently Amended) System An apparatus as per claim 36, characterised by the fact 
that whe-rein said first module apparatus is configured to repeatedly perform said tracing operations 
with a given frequency. 

39. (Currently Amended) System An apparatus as per claim 38, characterised by the fact 
that wherein said first module apparatus is configured so that said frequency can be determined and 
selected. 

40. (Currently Amended) System An apparatus as per claim 26, characterised by the fact 
that wherein said second module (B2) apparatus is configured to output a unique tree of autonomous 
systems paths crossed by the traffic of said user to reach all the destinations, the- and wherein leaves 
of said tree kew^are indicative of the-destination subnetworks of the traffic of said user. 

41. (Currently Amended) System An apparatus as per claim 26, characterised by the fact 
that wherein said second module (B2) is configured to provide, in relation to the list of said 
autonomous sy s tem s crossed by said traffic of said user. the provided at least one parameter from: the 
percentage of use of the autonomous svstem. further includes at least one of a value of time of 
permanence inside said autonomous systems and a value of hops inside said autonomous systems. 
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42. (Currently Amended) System An apparatus as per claim 41 , characterised by the fact 
tfrat wherein the at least one and preferably all said data provided at least one parameter are-is 
expressed as an average value. 

43. (Currently Amended) System An apparatus as per claim 26 or claim 36 , characterized by the 
fact that wherein said first modul e ( B I A pparatus is configured to invoke for each IP address 
generated via said tracing function (traceroute), a remote service to obtain at least one of the 
following pieces piece of information included in the group consisting o ff rom a group including : 
name of the autonomous system to which the generated IP address belongs and number of the 
autonomous system to which the aforesaid generated IP address belongs. 

44. (Currently Amended) Sy s tem An apparatus as per claim 43, characterised by the fact 
ibat wherein said remote service is the whois service of the databases RIBE, ARIN, APNIC. 

> 

45. (Currently Amended) System An apparatus as per claim 26, characterised by the fact 
ihat wherein said first module (Bl) apparatus outputs a data file (103) including information selected 
i n the group consisting o f from a group including : 

- order number of the autonomous system following the sequence of the IP addresses 
provided by said tracing function, 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has measured inside the autonomous system, 

and 

- time of permanence in the autonomous system measured by a single tracing command. 

46. (Currently Amended) System An apparatus as per claim 26 or claim 36 , characterized by the 
fact that where in said first module apparatus is configured to perform in parallel a plurality of said 
tracing functions. 
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47. (Currently Amended) System An apparatus as per claim 26, characterised by the fact 
that wherein said second module (B2) apparatus contains a cache memory to store information of 
correspondence between IP addresses and data relating to the pertinent autonomous systems. 

48. (Currently Amended) System An apparatus as per claim 26, charact e rised by the fact 
foat wherein said second module a pparatus is configured so that th^-leaves of said tree are the 
destination subnetworks of the traffic of said user and the-relative branches of said tree are the 
autonomous systems crossed by the traffic. 

49. (Currently Amended) System An apparatus as per claim 26, character i sed by the fact 
that where in said second module (Bl A pparatus is associated to one central memory with a data 
structure that represents the paths generated by said first module apparatus in the form of at least one 
aggregated list. 

50. (Currently Amended) Sy s tem An apparatus as per claim 49, characterised by the fact that 
the wherein said at least one aggregated list is identified as representing a variable number of 
autonomous system lists (VAS) that share a common maximum prefix. 

51. (Currently Amended) Computer program product A memory having stored thereon directly 
loadable in a numerical processor internal memory and including parts of software code t-e 
implement the procedure a s per any one of the claims 1 to 25 that, when the product is run 
en executed a proce s sor , performs: 

tracing traffic associated with a user of a data communication network: 
identifying a group of networks with which said traffic is mainly handled; and 
defining relative autonomous systems and tracing the sequence of autonomous systems 
crossed by said traffic, 

wherein the tracing includes: 
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- a first stage, to provide a list of paths of autonomous systems crossed by said traffic 
to reach each destination, and 

- a second stage, to aggregately elaborate said list of paths, outputting a tree 
representing all the paths of the autonomous systems crossed bv the traffic of said user to reach each 
destination, 

wherein said second stage comprises providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one parameter including the percentage of use of 
the autonomous systems . 
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